ProtonVPN[.]exe | Triage

Sharing

Copy URL Twitter E-mail

General

Target

ProtonVPN.exe
Size

7.2MB
MD5

bbdfa1d6790c663a569fc5b8dfecf810
SHA1

2191504f2a05f6b17b9476c4c7e005f8d3618f3a
SHA256

21feafefb5eff856a47945000c079d7c8954caf877b03a31b34ea9a546da3d33
SHA512

9f7e16d3bb3244557f0b2c826c18dabf199a81aff7b70b3d4bd1aa9d3e7a79a4bab1cb2c0c731744fcf2e1b24c56c48d1e90b13c8cbd2f9a453d5f7e0366fdea
SSDEEP

49152:1JqtFA/t3FUkQ3VeF7h9kNjbNczKZ6GMuenNMZ9gmgDKzGuMgsDafp6RjHSQH8ps:1eYJ6kOeFnAc3yPgmcKXYjHtAS9G6

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
ProtonVPN.exe

Files

ProtonVPN.exe
.exe windows:4 windows x86 arch:x86

f34d5f2d4577ed6d9ceec516c1f5a744

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

mscoree

_CorExeMain

Sections

.text
Size: 7.2MB - Virtual size: 7.2MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 36KB - Virtual size: 35KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ